You can add a log source extension to extend or modify
the parsing routines of specific devices.
Procedure
- Click the Admin tab.
- Click the Log Source Extensions icon.
- Click Add.
- From the Log Source Types list,
select one of the following options:
| Option |
Description |
| Available |
Select this option
when the device support module (DSM) correctly parses most
fields for the log source. The incorrectly parsed field values
are enhanced with the new XML values. |
| Set to default for |
Select log sources
to add or remove from the extension parsing. You can add
or remove extensions from a log source. When a log source
extension is Set to default for a log source,
new log sources of the same Log Source Type use
the assigned log source extension.
|
- Click Browse to locate your log
source extension XML document.
- Click Upload. The contents of the
log source extension is displayed to ensure that the proper extension
file is uploaded. The extension file is evaluated against the
XSD for errors when the file is uploaded.
- Click Save.
Results
If the extension file does not contain any errors, the new
log source extension is created and enabled. It is possible to upload
a log source extension without applying the extension to a log source.
Any change to the status of an extension is applied immediately and
managed hosts or Consoles enforce the new event parsing parameters
in the log source extension.
What to do next
On the Log Activity tab, verify that
the parsing patterns for events is applied correctly. If the
log source categorizes events as Stored,
the parsing pattern in the log source extension requires adjustment.
You can review the extension file against log source events
to locate any event parsing issues.